CVE-2026-75592: Kirby path traversal in media handling via sibling directory bypass

CVE-2026-75592 · Severity: medium · CVSS 4 · Published 2026-08-31

Kirby is a popular open-source content management system. A path traversal vulnerability in its media handling component allows attackers to access image files and other media assets from sibling directories adjacent to the main site root, such as staging sites or backups stored on the same server. An attacker can read or delete sensitive files in these sibling directories if they contain prepared thumbnail configuration files, potentially leading to information disclosure from internal sites.

Technologies: Kirby, getkirby/cms (Packagist). Vendors: Kirby, Packagist.

Quick answers

Is CVE-2026-75592 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-75592 being exploited in the wild.
How severe is CVE-2026-75592?
Medium severity, with a CVSS score of 4, published 31 August 2026.
Which products and versions are affected?
Kirby < 4.9.5, >= 5.0.0 and < 5.5.2; getkirby/cms (Packagist) ECOSYSTEM:introduced=0,fixed=4.9.5.
Is there a fix for CVE-2026-75592?
Yes. getkirby/cms (Packagist): upgrade to 4.9.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75592 attacked?
It is attacked over the network.
Am I affected by CVE-2026-75592?
Check whether you run Kirby or getkirby/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • getkirby/cms (Packagist): upgrade to 4.9.5 or later
    composer require getkirby/cms:^4.9.5

Technical details

The vulnerability is a path traversal (CWE-22) in Kirby's media handler that processes thumbnail generation requests. The media handler uses filesystem containment checks in the `Kirby\Filesystem\Dir::realpath()` and `Kirby\Filesystem\F::realpath()` functions to prevent directory escape attacks, but these checks fail to enforce proper directory boundary validation. Specifically, the containment logic accepts sibling directories that share the same name prefix as the target directory (e.g., `/var/www/site2` bypasses the check for `/var/www/site`), allowing traversal via path manipulation. The attack requires the presence of a prepared thumbnail job file (.json metadata) in the target sibling directory and read access to that directory from PHP; no authentication or user interaction is required. An attacker can access and read media files or delete job files from staging sites, backups, and other internal sites co-hosted on the same server. Patches were released in Kirby 4.9.5 and 5.5.2, which enforce exact-match or DIRECTORY_SEPARATOR-boundary validation in containment helpers and block paths containing `../` sequences in the Asset class.

Affected products

  • Kirby Kirby CMS < 4.9.5, >= 5.0.0 and < 5.5.2

Identifiers

  • CVE-2026-75592
  • GHSA-6j4c-mgqr-qv76

Timeline

  • 2026-07-15: disclosed
  • 2026-09-02: patched: Kirby 4.9.5 and 5.5.2 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.